Description
Threshold tunables, D-LBL8 size floor and static-infrastructure allowlist, coverage floor and budget seconds through the existing tunables path; opt-out list respected. Update RUNBOOK.md, CAPABILITIES.md, SPEC.md and docs/traps.md to state exactly what is and is not inspected.
Acceptance Criteria
- #1 just tf-validate passes with the new variables
- #2 CAPABILITIES.md and SPEC.md state what label_inventory reads, persists and never persists
Definition of Done
- #1 just test
- #2 just tf-validate
- #3 just check-identifiers and just no-em-dashes both return clean
Implementation Plan
Wire existing default-off enablement and tunables into Terraform/config/docs; read-only stability recipe; preserve missing/PII/gap semantics. Narrow validation then root joint stable gate after disjoint writers quiesce.
Implementation Notes
loop14:default-off config/Terraform/projection/tunable forwarding and read-only dated stability recipe accepted.2 implementation attempts/2 guarded rounds; original major nonpublishing/publication-linkage proof gap fixed, actual empty/subset/raw/memory/policy negatives preserved. Final exact ae10a3a justcheck2325passed/2skips and CI37584017497 everyrequiredleafsuccess. CodeRabbit repaired3-file delta exact isolated pre-repair commit5ccb487c complete0findings. No live stability/observed memory claim.